One of the specific features of the aeronautical sector is that each display parameter and each interaction that a pilot is able to perform with the avionic system is defined by a ‘safety’ level of criticality that defines the criteria regarding integrity and availability of the hardware. For example, the level called ‘hazardous’ integrity level requires a probability of error of less than 10−7 per flight hour. Critical interactions have been performed, up until now, using dedicated control panels having the correct integrity level. For reasons regarding manufacturing and maintenance costs, but also for reasons regarding bulk, weight and electrical consumption, aviators are looking to reduce the number of control housings and to replace them with virtual equivalents that are displayed on the large touch-surface viewing screens of cockpits.
However, the essential condition for a control housing to be able to be ‘virtualized’ within a main screen is that this screen has at least the same level of criticality as the control housing that it is replacing. The inherent reliability of the components of a viewing screen means that the latter does not allow direct generation of highly critical commands. Thus, it is not possible simply to replace the action on one or more critical control buttons with a similar action on a touch surface.
Touch interaction means, notably capacitive ones, offer the option of performing a complex gesture able to be identified by the touchscreen, where a simple button allows only pressing and release functions to be applied. Thus, document U.S. Pat. No. 8,046,721, entitled ‘Unlocking a device by performing gestures on an unlock image’, proposes unlocking an electronic device by performing a particular ‘gesture’.
However, an arbitrary gesture does not make it possible to ensure the required reliability. Specifically, some simple faults with the touch surface may have the same effect as a simple gesture. This is the case with what are called ‘untimely’ presses. The touchscreen sends an item of information without any press from the user. This item of information may correspond to an isolated press or a succession of presses on a row or a column. This is also the case with what are called ‘erroneous’ presses. When pressing on the screen, the latter sends incorrect coordinates that do not match the actual location of the press. Thus, the fault with the touchscreen may simulate simple gestures, such as a simple press, a long press, a press along a row or a column, and thus generate incorrect commands, which is not acceptable.
To solve this problem, in existing interactive systems, when it is desired to ensure that the interaction has indeed been requested by a user and does not result from a fault, what is called the ‘guard’ principle is used. This principle is implemented on mechanical control buttons that require a high degree of security. It consists in protecting the control button by way of a cover. The button is able to be used only after the cover has been lifted. This principle may be transposed to touch commands. As illustrated in FIG. 1, this principle consists in asking the user to perform two actions on a touch surface 1 to confirm his interaction. First of all, illustrated in the left-hand drawing of FIG. 1, the user performs a first press on a virtual button 2. The device then requests confirmation. This request may be made through a change in appearance of the virtual button. The user then performs a second press, as illustrated in the middle drawing. The device confirms the second press and performs the action. This confirmation may also be made through a second change in appearance of the virtual button, as illustrated in the right-hand drawing. However, this mechanism does not guarantee complete integrity of the touch surface. If the user lifts the guard and is interrupted in his task, a simple fault with the touchscreen may confirm activation.